Drop ufw config

8 files changed, 0 insertions, 453 deletions

diff --git a/ufw/ufw/after.rules b/ufw/ufw/after.rules
deleted file mode 100644
index 0d6c646..0000000
--- a/ufw/ufw/after.rules
+++ /dev/null
@@ -1,30 +0,0 @@
-#
-# rules.input-after
-#
-# Rules that should be run after the ufw command line added rules. Custom
-# rules should be added to one of these chains:
-#   ufw-after-input
-#   ufw-after-output
-#   ufw-after-forward
-#
-
-# Don't delete these required lines, otherwise there will be errors
-*filter
-:ufw-after-input - [0:0]
-:ufw-after-output - [0:0]
-:ufw-after-forward - [0:0]
-# End required lines
-
-# don't log noisy services by default
--A ufw-after-input -p udp --dport 137 -j ufw-skip-to-policy-input
--A ufw-after-input -p udp --dport 138 -j ufw-skip-to-policy-input
--A ufw-after-input -p tcp --dport 139 -j ufw-skip-to-policy-input
--A ufw-after-input -p tcp --dport 445 -j ufw-skip-to-policy-input
--A ufw-after-input -p udp --dport 67 -j ufw-skip-to-policy-input
--A ufw-after-input -p udp --dport 68 -j ufw-skip-to-policy-input
-
-# don't log noisy broadcast
--A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-
-# don't delete the 'COMMIT' line or these rules won't be processed
-COMMIT
diff --git a/ufw/ufw/after6.rules b/ufw/ufw/after6.rules
deleted file mode 100644
index 0d99672..0000000
--- a/ufw/ufw/after6.rules
+++ /dev/null
@@ -1,27 +0,0 @@
-#
-# rules.input-after
-#
-# Rules that should be run after the ufw command line added rules. Custom
-# rules should be added to one of these chains:
-#   ufw6-after-input
-#   ufw6-after-output
-#   ufw6-after-forward
-#
-
-# Don't delete these required lines, otherwise there will be errors
-*filter
-:ufw6-after-input - [0:0]
-:ufw6-after-output - [0:0]
-:ufw6-after-forward - [0:0]
-# End required lines
-
-# don't log noisy services by default
--A ufw6-after-input -p udp --dport 137 -j ufw6-skip-to-policy-input
--A ufw6-after-input -p udp --dport 138 -j ufw6-skip-to-policy-input
--A ufw6-after-input -p tcp --dport 139 -j ufw6-skip-to-policy-input
--A ufw6-after-input -p tcp --dport 445 -j ufw6-skip-to-policy-input
--A ufw6-after-input -p udp --dport 546 -j ufw6-skip-to-policy-input
--A ufw6-after-input -p udp --dport 547 -j ufw6-skip-to-policy-input
-
-# don't delete the 'COMMIT' line or these rules won't be processed
-COMMIT
diff --git a/ufw/ufw/before.rules b/ufw/ufw/before.rules
deleted file mode 100644
index 23b384e..0000000
--- a/ufw/ufw/before.rules
+++ /dev/null
@@ -1,75 +0,0 @@
-#
-# rules.before
-#
-# Rules that should be run before the ufw command line added rules. Custom
-# rules should be added to one of these chains:
-#   ufw-before-input
-#   ufw-before-output
-#   ufw-before-forward
-#
-
-# Don't delete these required lines, otherwise there will be errors
-*filter
-:ufw-before-input - [0:0]
-:ufw-before-output - [0:0]
-:ufw-before-forward - [0:0]
-:ufw-not-local - [0:0]
-# End required lines
-
-
-# allow all on loopback
--A ufw-before-input -i lo -j ACCEPT
--A ufw-before-output -o lo -j ACCEPT
-
-# quickly process packets for which we already have a connection
--A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# drop INVALID packets (logs these in loglevel medium and higher)
--A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
--A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-
-# ok icmp codes for INPUT
--A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
--A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
--A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
--A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
-
-# ok icmp code for FORWARD
--A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
--A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
--A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
--A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
-
-# allow dhcp client to work
--A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
-
-#
-# ufw-not-local
-#
--A ufw-before-input -j ufw-not-local
-
-# if LOCAL, RETURN
--A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-
-# if MULTICAST, RETURN
--A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-
-# if BROADCAST, RETURN
--A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-
-# all other non-local packets are dropped
--A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
--A ufw-not-local -j DROP
-
-# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
-# is uncommented)
--A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
-
-# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
-# is uncommented)
--A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
-
-# don't delete the 'COMMIT' line or these rules won't be processed
-COMMIT
diff --git a/ufw/ufw/before6.rules b/ufw/ufw/before6.rules
deleted file mode 100644
index abebbe7..0000000
--- a/ufw/ufw/before6.rules
+++ /dev/null
@@ -1,142 +0,0 @@
-#
-# rules.before
-#
-# Rules that should be run before the ufw command line added rules. Custom
-# rules should be added to one of these chains:
-#   ufw6-before-input
-#   ufw6-before-output
-#   ufw6-before-forward
-#
-
-# Don't delete these required lines, otherwise there will be errors
-*filter
-:ufw6-before-input - [0:0]
-:ufw6-before-output - [0:0]
-:ufw6-before-forward - [0:0]
-# End required lines
-
-
-# allow all on loopback
--A ufw6-before-input -i lo -j ACCEPT
--A ufw6-before-output -o lo -j ACCEPT
-
-# drop packets with RH0 headers
--A ufw6-before-input -m rt --rt-type 0 -j DROP
--A ufw6-before-forward -m rt --rt-type 0 -j DROP
--A ufw6-before-output -m rt --rt-type 0 -j DROP
-
-# quickly process packets for which we already have a connection
--A ufw6-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A ufw6-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A ufw6-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# multicast ping replies are part of the ok icmp codes for INPUT (rfc4890,
-# 4.4.1 and 4.4.2), but don't have an associated connection and are otherwise
-# be marked INVALID, so allow here instead.
--A ufw6-before-input -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
-
-# drop INVALID packets (logs these in loglevel medium and higher)
--A ufw6-before-input -m conntrack --ctstate INVALID -j ufw6-logging-deny
--A ufw6-before-input -m conntrack --ctstate INVALID -j DROP
-
-# ok icmp codes for INPUT (rfc4890, 4.4.1 and 4.4.2)
--A ufw6-before-input -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
--A ufw6-before-input -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-# codes 0 and 1
--A ufw6-before-input -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
-# codes 0-2 (echo-reply needs to be before INVALID, see above)
--A ufw6-before-input -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
--A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j ACCEPT
--A ufw6-before-input -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
--A ufw6-before-input -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
--A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
--A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
-# IND solicitation
--A ufw6-before-input -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
-# IND advertisement
--A ufw6-before-input -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
-# MLD query
--A ufw6-before-input -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
-# MLD report
--A ufw6-before-input -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
-# MLD done
--A ufw6-before-input -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
-# MLD report v2
--A ufw6-before-input -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
-# SEND certificate path solicitation
--A ufw6-before-input -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
-# SEND certificate path advertisement
--A ufw6-before-input -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
-# MR advertisement
--A ufw6-before-input -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
-# MR solicitation
--A ufw6-before-input -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
-# MR termination
--A ufw6-before-input -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
-
-# ok icmp codes for OUTPUT (rfc4890, 4.4.1 and 4.4.2)
--A ufw6-before-output -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
--A ufw6-before-output -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-# codes 0 and 1
--A ufw6-before-output -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
-# codes 0-2
--A ufw6-before-output -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
--A ufw6-before-output -p icmpv6 --icmpv6-type echo-request -j ACCEPT
--A ufw6-before-output -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
--A ufw6-before-output -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
--A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
--A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
--A ufw6-before-output -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
-# IND solicitation
--A ufw6-before-output -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
-# IND advertisement
--A ufw6-before-output -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
-# MLD query
--A ufw6-before-output -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
-# MLD report
--A ufw6-before-output -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
-# MLD done
--A ufw6-before-output -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
-# MLD report v2
--A ufw6-before-output -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
-# SEND certificate path solicitation
--A ufw6-before-output -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
-# SEND certificate path advertisement
--A ufw6-before-output -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
-# MR advertisement
--A ufw6-before-output -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
-# MR solicitation
--A ufw6-before-output -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
-# MR termination
--A ufw6-before-output -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
-
-# ok icmp codes for FORWARD (rfc4890, 4.3.1)
--A ufw6-before-forward -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
--A ufw6-before-forward -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-# codes 0 and 1
--A ufw6-before-forward -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
-# codes 0-2
--A ufw6-before-forward -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
--A ufw6-before-forward -p icmpv6 --icmpv6-type echo-request -j ACCEPT
--A ufw6-before-forward -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
-# ok icmp codes for FORWARD (rfc4890, 4.3.2)
-# Home Agent Address Discovery Reques
--A ufw6-before-input -p icmpv6 --icmpv6-type 144 -j ACCEPT
-# Home Agent Address Discovery Reply
--A ufw6-before-input -p icmpv6 --icmpv6-type 145 -j ACCEPT
-# Mobile Prefix Solicitation
--A ufw6-before-input -p icmpv6 --icmpv6-type 146 -j ACCEPT
-# Mobile Prefix Advertisement
--A ufw6-before-input -p icmpv6 --icmpv6-type 147 -j ACCEPT
-
-# allow dhcp client to work
--A ufw6-before-input -p udp -s fe80::/10 --sport 547 -d fe80::/10 --dport 546 -j ACCEPT
-
-# allow MULTICAST mDNS for service discovery
--A ufw6-before-input -p udp -d ff02::fb --dport 5353 -j ACCEPT
-
-# allow MULTICAST UPnP for service discovery
--A ufw6-before-input -p udp -d ff02::f --dport 1900 -j ACCEPT
-
-# don't delete the 'COMMIT' line or these rules won't be processed
-COMMIT
diff --git a/ufw/ufw/sysctl.conf b/ufw/ufw/sysctl.conf
deleted file mode 100644
index 4ea2032..0000000
--- a/ufw/ufw/sysctl.conf
+++ /dev/null
@@ -1,57 +0,0 @@
-#
-# Configuration file for setting network variables. Please note these settings
-# override /etc/sysctl.conf. If you prefer to use /etc/sysctl.conf, please
-# adjust IPT_SYSCTL in /etc/default/ufw.
-#
-
-# Uncomment this to allow this host to route packets between interfaces
-#net/ipv4/ip_forward=1
-#net/ipv6/conf/default/forwarding=1
-#net/ipv6/conf/all/forwarding=1
-
-# Turn on Source Address Verification in all interfaces to prevent some
-# spoofing attacks
-net/ipv4/conf/default/rp_filter=1
-net/ipv4/conf/all/rp_filter=1
-
-# Do not accept IP source route packets (we are not a router)
-net/ipv4/conf/default/accept_source_route=0
-net/ipv4/conf/all/accept_source_route=0
-net/ipv6/conf/default/accept_source_route=0
-net/ipv6/conf/all/accept_source_route=0
-
-# Disable ICMP redirects. ICMP redirects are rarely used but can be used in
-# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate
-# traffic to those sites.
-net/ipv4/conf/default/accept_redirects=0
-net/ipv4/conf/all/accept_redirects=0
-net/ipv6/conf/default/accept_redirects=0
-net/ipv6/conf/all/accept_redirects=0
-
-# Ignore bogus ICMP errors
-net/ipv4/icmp_echo_ignore_broadcasts=1
-net/ipv4/icmp_ignore_bogus_error_responses=1
-net/ipv4/icmp_echo_ignore_all=0
-
-# Don't log Martian Packets (impossible packets)
-net/ipv4/conf/default/log_martians=0
-net/ipv4/conf/all/log_martians=0
-
-# Change to '0' to disable TCP/IP SYN cookies. A value of '1' disables TCP
-# Window Scaling (http://lkml.org/lkml/2008/2/5/167).
-#net/ipv4/tcp_syncookies=1
-
-#net/ipv4/tcp_fin_timeout=30
-#net/ipv4/tcp_keepalive_intvl=1800
-
-# normally allowing tcp_sack is ok, but if going through OpenBSD 3.8 RELEASE or
-# earlier pf firewall, should set this to 0
-net/ipv4/tcp_sack=1
-
-# Uncomment this to turn off ipv6 autoconfiguration
-#net/ipv6/conf/default/autoconf=0
-#net/ipv6/conf/all/autoconf=0
-
-# Uncomment this to enable ipv6 privacy addressing
-#net/ipv6/conf/default/use_tempaddr=2
-#net/ipv6/conf/all/use_tempaddr=2
diff --git a/ufw/ufw/ufw.conf b/ufw/ufw/ufw.conf
deleted file mode 100644
index 28fe534..0000000
--- a/ufw/ufw/ufw.conf
+++ /dev/null
@@ -1,10 +0,0 @@
-# /etc/ufw/ufw.conf
-#
-
-# Set to yes to start on boot. If setting this remotely, be sure to add a rule
-# to allow your remote connection before starting ufw. Eg: 'ufw allow 22/tcp'
-ENABLED=yes
-
-# Please use the 'ufw' command to set the loglevel. Eg: 'ufw logging medium'.
-# See 'man ufw' for details.
-LOGLEVEL=low
diff --git a/ufw/ufw/user.rules b/ufw/ufw/user.rules
deleted file mode 100644
index 3a3b8b2..0000000
--- a/ufw/ufw/user.rules
+++ /dev/null
@@ -1,56 +0,0 @@
-*filter
-:ufw-user-input - [0:0]
-:ufw-user-output - [0:0]
-:ufw-user-forward - [0:0]
-:ufw-before-logging-input - [0:0]
-:ufw-before-logging-output - [0:0]
-:ufw-before-logging-forward - [0:0]
-:ufw-user-logging-input - [0:0]
-:ufw-user-logging-output - [0:0]
-:ufw-user-logging-forward - [0:0]
-:ufw-after-logging-input - [0:0]
-:ufw-after-logging-output - [0:0]
-:ufw-after-logging-forward - [0:0]
-:ufw-logging-deny - [0:0]
-:ufw-logging-allow - [0:0]
-:ufw-user-limit - [0:0]
-:ufw-user-limit-accept - [0:0]
-### RULES ###
-
-### tuple ### allow any 443 0.0.0.0/0 any 0.0.0.0/0 out
--A ufw-user-output -p tcp --dport 443 -j ACCEPT
--A ufw-user-output -p udp --dport 443 -j ACCEPT
-
-### tuple ### allow any 80 0.0.0.0/0 any 0.0.0.0/0 out
--A ufw-user-output -p tcp --dport 80 -j ACCEPT
--A ufw-user-output -p udp --dport 80 -j ACCEPT
-
-### tuple ### allow any 53 0.0.0.0/0 any 0.0.0.0/0 DNS - out
--A ufw-user-output -p tcp --dport 53 -j ACCEPT -m comment --comment 'dapp_DNS'
--A ufw-user-output -p udp --dport 53 -j ACCEPT -m comment --comment 'dapp_DNS'
-
-### tuple ### allow any 22 0.0.0.0/0 any 0.0.0.0/0 in
--A ufw-user-input -p tcp --dport 22 -j ACCEPT
--A ufw-user-input -p udp --dport 22 -j ACCEPT
-
-### tuple ### allow any 22 0.0.0.0/0 any 0.0.0.0/0 out
--A ufw-user-output -p tcp --dport 22 -j ACCEPT
--A ufw-user-output -p udp --dport 22 -j ACCEPT
-
-### END RULES ###
-
-### LOGGING ###
--A ufw-after-logging-input -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--A ufw-after-logging-output -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--A ufw-after-logging-forward -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--I ufw-logging-deny -m conntrack --ctstate INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
--A ufw-logging-deny -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--A ufw-logging-allow -j LOG --log-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10
-### END LOGGING ###
-
-### RATE LIMITING ###
--A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT BLOCK] "
--A ufw-user-limit -j REJECT
--A ufw-user-limit-accept -j ACCEPT
-### END RATE LIMITING ###
-COMMIT
diff --git a/ufw/ufw/user6.rules b/ufw/ufw/user6.rules
deleted file mode 100644
index 8abf7ea..0000000
--- a/ufw/ufw/user6.rules
+++ /dev/null
@@ -1,56 +0,0 @@
-*filter
-:ufw6-user-input - [0:0]
-:ufw6-user-output - [0:0]
-:ufw6-user-forward - [0:0]
-:ufw6-before-logging-input - [0:0]
-:ufw6-before-logging-output - [0:0]
-:ufw6-before-logging-forward - [0:0]
-:ufw6-user-logging-input - [0:0]
-:ufw6-user-logging-output - [0:0]
-:ufw6-user-logging-forward - [0:0]
-:ufw6-after-logging-input - [0:0]
-:ufw6-after-logging-output - [0:0]
-:ufw6-after-logging-forward - [0:0]
-:ufw6-logging-deny - [0:0]
-:ufw6-logging-allow - [0:0]
-:ufw6-user-limit - [0:0]
-:ufw6-user-limit-accept - [0:0]
-### RULES ###
-
-### tuple ### allow any 443 ::/0 any ::/0 out
--A ufw6-user-output -p tcp --dport 443 -j ACCEPT
--A ufw6-user-output -p udp --dport 443 -j ACCEPT
-
-### tuple ### allow any 80 ::/0 any ::/0 out
--A ufw6-user-output -p tcp --dport 80 -j ACCEPT
--A ufw6-user-output -p udp --dport 80 -j ACCEPT
-
-### tuple ### allow any 53 ::/0 any ::/0 DNS - out
--A ufw6-user-output -p tcp --dport 53 -j ACCEPT -m comment --comment 'dapp_DNS'
--A ufw6-user-output -p udp --dport 53 -j ACCEPT -m comment --comment 'dapp_DNS'
-
-### tuple ### allow any 22 ::/0 any ::/0 in
--A ufw6-user-input -p tcp --dport 22 -j ACCEPT
--A ufw6-user-input -p udp --dport 22 -j ACCEPT
-
-### tuple ### allow any 22 ::/0 any ::/0 out
--A ufw6-user-output -p tcp --dport 22 -j ACCEPT
--A ufw6-user-output -p udp --dport 22 -j ACCEPT
-
-### END RULES ###
-
-### LOGGING ###
--A ufw6-after-logging-input -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--A ufw6-after-logging-output -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--A ufw6-after-logging-forward -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--I ufw6-logging-deny -m conntrack --ctstate INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
--A ufw6-logging-deny -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
--A ufw6-logging-allow -j LOG --log-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10
-### END LOGGING ###
-
-### RATE LIMITING ###
--A ufw6-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT BLOCK] "
--A ufw6-user-limit -j REJECT
--A ufw6-user-limit-accept -j ACCEPT
-### END RATE LIMITING ###
-COMMIT